30a17e2e5f03ee031b34f052cc3d91815347e722959af7761ce5fca13505b25e

General

Target

30a17e2e5f03ee031b34f052cc3d91815347e722959af7761ce5fca13505b25e.xls
Size

126KB
MD5

583771d67fe155845f228c08cc38db97
SHA1

368edc3459177a5dd8d5f3a62737145e4180dd89
SHA256

30a17e2e5f03ee031b34f052cc3d91815347e722959af7761ce5fca13505b25e
SHA512

20ff52eb74376b3f7bd95f47c16012879b775819162918fd778113e1c8a865e2bfcad5a7bafa48219ef99dfe1d12d0af1c1d49e00fd245d205ec84257ab47a5b
SSDEEP

3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlCt:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgRs

Score

10^/10

Malware Config

Extracted

Language

xlm4.0

Source

URLs

xlm40.dropper

http://med.devsrm.com/wp-content/gtOOTHi3zkUbn8U6/

xlm40.dropper

http://izytalab.com/includes/1mafAX0kOa/

xlm40.dropper

https://pcsolutionss.com/zSlT4HR92TiOpw5NM/

xlm40.dropper

http://www.doctorcasenave.com/wp-content/O2Z1HMebIXiHYBBS/

xlm40.dropper

https://wpl28.realtyna.com/wp-content/0b0ny5cPM/

xlm40.dropper

http://www.efcballjoint.com/Template/AxEZPOfAa9/

Signatures

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2636	EXCEL.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2636	EXCEL.EXE
2636	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2636	EXCEL.EXE
2636	EXCEL.EXE
2636	EXCEL.EXE
2636	EXCEL.EXE
2636	EXCEL.EXE
2636	EXCEL.EXE
2636	EXCEL.EXE
2636	EXCEL.EXE

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\30a17e2e5f03ee031b34f052cc3d91815347e722959af7761ce5fca13505b25e.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms

Filesize
1KB

MD5
1c904fa33f6d0c34c2aff2d36d1ecc6f

SHA1
1075a6d008df6c9f44c3d3631ef04f2dd8401826

SHA256
2174a08fbbb8cc667c9efa7f6cdd08102ffae035b41f8ff17a3e71f6d01f26fa

SHA512
464af0a4cff15f83d4b5a9e53e57f14967ea25ef608d7258f2bc1b74f2b7e8ba071d9c1a485f6ffd934f6ad6b19db3d83219950f3ee176cc1674e96747462ecd

Download Submit
memory/2636-12-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-10-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-8-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-5-0x00007FF802A50000-0x00007FF802A60000-memory.dmp

Filesize
64KB

Download
memory/2636-7-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-11-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-9-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-13-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-14-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-17-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-16-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-6-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-15-0x00007FF800760000-0x00007FF800770000-memory.dmp

Filesize
64KB

Download
memory/2636-0-0x00007FF802A50000-0x00007FF802A60000-memory.dmp

Filesize
64KB

Download
memory/2636-3-0x00007FF802A50000-0x00007FF802A60000-memory.dmp

Filesize
64KB

Download
memory/2636-4-0x00007FF802A50000-0x00007FF802A60000-memory.dmp

Filesize
64KB

Download
memory/2636-18-0x00007FF800760000-0x00007FF800770000-memory.dmp

Filesize
64KB

Download
memory/2636-2-0x00007FF802A50000-0x00007FF802A60000-memory.dmp

Filesize
64KB

Download
memory/2636-38-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-39-0x00007FF842A6D000-0x00007FF842A6E000-memory.dmp

Filesize
4KB

Download
memory/2636-40-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-41-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-44-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-46-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-45-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-43-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-42-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-47-0x00007FF8429D0000-0x00007FF842BC5000-memory.dmp

Filesize
2.0MB

Download
memory/2636-1-0x00007FF842A6D000-0x00007FF842A6E000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads